ftp[.]firstvault[.]site

The domain ftp.firstvault.site is presently flagged as a high‑risk generic phishing endpoint. VirusTotal analysis shows that three of ninety‑one scanning engines have reported malicious activity, indicating that at least a minority of AV products recognize the site as suspicious. The domain resolves to the nameservers vda6100a.trouble-free.net and vda6100b.trouble-free.net, which are commonly associated with low‑cost hosting services and provide limited attribution. An HTTP request returns a 200 OK status, confirming that a web service is actively responding on the host. Registration data lists HOSTINGER operations, UAB as the registrar, a known bulk‑registration provider, which reduces confidence in the legitimacy of the domain owner. The site is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing organization considers the domain malicious.

The operational status is marked as active, meaning the phishing infrastructure is still live. Several critical aspects remain unknown. No public SSL/TLS certificate information has been observed, so the use of HTTPS cannot be confirmed. The underlying IP address, autonomous system number, and geographic location have not been disclosed, limiting the ability to perform network‑level attribution. Content analysis of the landing page, including page title or any brand impersonation, has not been published, so the exact phishing vector cannot be detailed.

Likewise, Safe Browsing or Open Threat Exchange signals are not currently available for this host. Defenders should immediately add ftp.firstvault.site to corporate URL filtering and DNS blocklists, enforce sink‑hole routing where feasible, and monitor outbound traffic for connections to the associated nameservers. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any changes in detection rates.